What's new 
We are setting up Windows LAPS through Hexnode and ran into a strange issue. The policy is deployed to a Windows device with LAPS enabled, “Include default admin account” selected, and a custom local admin account added under “Target admin accounts”. The policy shows as deployed, the Hexnode UEM app is installed, and we already tried Scan Device and Sync Local Accounts. But under Device Details > Local Accounts > LAPS, the table stays completely blank. If the policy creates a new local admin account using the “Automatically Create Account” option, the password is managed and the LAPS table populates correctly. The issue happens with local administrator accounts that already existed on the device, including the built-in Administrator account and another custom admin account. Does Hexnode LAPS support existing local admin accounts, or only accounts created by the policy?
36 Views
Replies (4)
Hexnode LAPS can manage local administrator accounts targeted by the Windows LAPS policy, but the account state on the Windows device matters.
For the built-in Administrator account, check whether the account is disabled on the device. If it is disabled, enable the Enable disabled admin accounts option in the Windows LAPS policy and redeploy the policy. After that, run Scan Device and Sync Local Accounts again.
For a custom local admin account that already exists and is enabled, confirm the following:
- The account name in Target admin accounts exactly matches the local account name on the device.
- The account has local administrator privileges.
- The Windows LAPS policy is reapplied after making changes.
- Local accounts are synced again from the device action menu.
If the built-in Administrator starts appearing after enabling disabled admin accounts, but the custom admin account still does not appear, the issue may be related to the local account password state on the device. In that case, change the password of the affected local admin account once on the device, reapply the LAPS policy, and then check the LAPS table again.
We also have another local admin account that already existed on the device. That account is enabled and has admin rights, but disabling and enabling it did not help. The LAPS table still stayed blank for that account.
For the additional existing admin account, try changing the password of that local admin account manually once, then reapply the same Windows LAPS policy to the device.
After reapplying the policy, trigger:
- Scan Device
- Sync Local Accounts
Then check Device Details > Local Accounts > LAPS again. In a similar case, the existing account was not being picked up because the password state had not been updated properly in the local account database. Once the password was changed and the policy was applied again, Hexnode was able to manage the account and populate the LAPS entry.
Changing the password for the existing custom admin account and reapplying the policy worked. The account is now listed in the LAPS table and password rotation is working. So the issue was not that Hexnode could only manage policy-created accounts. The existing account needed its password refreshed locally before Hexnode could take over management.
